Bulk create or update annotations
Bulk upload of annotations. Annotations are individual findings that have been identified as part of a report, for example, a line of code that represents a vulnerability. These annotations can be attached to a specific file and even a specific line in that file, however, that is optional. Annotations are not mandatory and a report can contain up to 1000 annotations.
Add the annotations you want to upload as objects in a JSON array and make sure each annotation has the external_id field set to a unique value. If you want to use an existing id from your own system, we recommend prefixing it with your system’s name to avoid collisions, for example, mySystem-annotation001. The external id can later be used to identify the report as an alternative to the generated UUID. You can upload up to 100 annotations per POST request.
Sample cURL request:
curl --location 'https://api.bitbucket.org/2.0/repositories/<username>/<reposity-name>/commit/<commit-hash>/reports/mysystem-001/annotations' \
--header 'Content-Type: application/json' \
--data-raw '[
{
"external_id": "mysystem-annotation001",
"title": "Security scan report",
"annotation_type": "VULNERABILITY",
"summary": "This line represents a security threat.",
"severity": "HIGH",
"path": "my-service/src/main/java/com/myCompany/mysystem/logic/Main.java",
"line": 42
},
{
"external_id": "mySystem-annotation002",
"title": "Bug report",
"annotation_type": "BUG",
"result": "FAILED",
"summary": "This line might introduce a bug.",
"severity": "MEDIUM",
"path": "my-service/src/main/java/com/myCompany/mysystem/logic/Helper.java",
"line": 13
}
]'Possible field values:
annotation_type: VULNERABILITY, CODE_SMELL, BUG result: PASSED, FAILED, IGNORED, SKIPPED severity: HIGH, MEDIUM, LOW, CRITICAL
Please refer to the Code Insights documentation for more information.
Authorizations
Section titled “ Authorizations ”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “ Path Parameters ”This can either be the workspace ID (slug) or the workspace UUID surrounded by curly-braces, for example {workspace UUID}.
The repository.
The commit for which to retrieve reports.
Uuid or external-if of the report for which to get annotations for.
Request Body required
Section titled “ Request Body required ”The annotations to create or update
object
ID of the annotation provided by the annotation creator. It can be used to identify the annotation as an alternative to it’s generated uuid. It is not used by Bitbucket, but only by the annotation creator for updating or deleting this specific annotation. Needs to be unique.
The UUID that can be used to identify the annotation.
The type of the report.
The path of the file on which this annotation should be placed. This is the path of the file relative to the git repository. If no path is provided, then it will appear in the overview modal on all pull requests where the tip of the branch is the given commit, regardless of which files were modified.
The line number that the annotation should belong to. If no line number is provided, then it will default to 0 and in a pull request it will appear at the top of the file specified by the path field.
The message to display to users.
The details to show to users when clicking on the annotation.
The state of the report. May be set to PENDING and later updated.
The severity of the annotation.
A URL linking to the annotation in an external tool.
The timestamp when the report was created.
The timestamp when the report was updated.
Responses
Section titled “ Responses ”OK
object
ID of the annotation provided by the annotation creator. It can be used to identify the annotation as an alternative to it’s generated uuid. It is not used by Bitbucket, but only by the annotation creator for updating or deleting this specific annotation. Needs to be unique.
The UUID that can be used to identify the annotation.
The type of the report.
The path of the file on which this annotation should be placed. This is the path of the file relative to the git repository. If no path is provided, then it will appear in the overview modal on all pull requests where the tip of the branch is the given commit, regardless of which files were modified.
The line number that the annotation should belong to. If no line number is provided, then it will default to 0 and in a pull request it will appear at the top of the file specified by the path field.
The message to display to users.
The details to show to users when clicking on the annotation.
The state of the report. May be set to PENDING and later updated.
The severity of the annotation.
A URL linking to the annotation in an external tool.
The timestamp when the report was created.
The timestamp when the report was updated.
Example
[ { "annotation_type": "VULNERABILITY", "result": "PASSED", "severity": "CRITICAL" }]